The best defense against a scam that tricks you into pasting malicious commands is a browser that reads the page for you. That’s the pitch. The catch is that the reader is Google.
According to a report from Chrome Unboxed, Google is upgrading Safe Browsing in Chrome to counter modern social engineering, from fake sites to deceptive clipboard commands. The headline feature uses Gemini inside Enhanced Protection to spot ClickFix attacks, where a page convinces you to copy a command and run it in a terminal or the Windows Run box.
ClickFix works because it skips the usual defenses. No exploit is needed and no file is downloaded. A fake CAPTCHA or error message tells you to press a few keys, and you infect yourself. Traditional blocklists struggle here because the page itself can look harmless, and the real payload is a string of text you deliver by hand. Attackers have used this trick to push infostealers and remote access tools, and it has spread quickly because it is cheap and effective.
So a smarter filter makes sense. Static lists of bad URLs can’t keep up with pages that change hourly. Analyzing page content and intent with a language model is a reasonable response to that problem.
But look at what Enhanced Protection is. It is the opt-in mode where Chrome shares more data with Google in real time, including URLs and snippets of page content, so it can judge threats faster. Google says this data is used for security. Still, you are trusting a company whose main business is advertising with a deeper view of your browsing. The report doesn’t make clear how much page content leaves your device, how long it is retained, or whether the analysis runs locally or in the cloud. Those details matter, and they deserve straight answers.
There is also a trade-off in who gets protected. Users who stay in Standard Protection keep more privacy but may miss the best defenses. Security that depends on handing over more data is a pattern we’ve seen before, and it quietly pushes people to pick safety or privacy rather than both.
The wider trend is clear. Browser vendors are moving from blocklists to AI-driven, behavior-based detection, and attackers are moving from malware to manipulating people. Both sides are escalating.
My advice is simple. If you’re prone to clicking things, Enhanced Protection is probably worth the exchange. If you’re careful, the best ClickFix defense is free: never paste a command from a website into a terminal you don’t fully understand. And ask Google to publish exactly what Gemini sees.